Vulnerability present in many now-patched antivirus products including Malwarebytes allowed malware to leave quarantine and gain full system control
New AVGater flaw provided key ingredient for hacker to hijack computer. — Antivirus programs, in many cases, make us safer on the Internet.
Context & Ripple Effects
The AVGater disclosure lands a year after Microsoft had to patch a remote code-execution bug in its malware protection engine — the component shipped in nearly every version of Windows — and two years after AVG's own forcibly installed Chrome extension exposed browsing data for millions of users. Both episodes established that security software is itself high-value attack surface; AVGater extends that pattern from detection engines and add-ons to the quarantine mechanism at the core of how antivirus products contain threats.
What makes AVGater notable within this arc is its position in the kill chain: rather than being the way malware gets in, it was the ingredient that let already-detected malware break out of containment and take full control of the system. Vendors including Malwarebytes have now patched, but the disclosure reframes quarantine — the trust boundary customers assume holds — as an exploitable step.
First-order effects
- Users of the affected antivirus products, including Malwarebytes customers, needed to apply the released patches immediately, since any malware already quarantined on their machines could use the flaw to escape and gain full system control.
Second-order effects
- Antivirus vendors face pressure to treat their own containment and remediation code with the same scrutiny they apply to operating systems, following the path set by Microsoft's engine-wide patch earlier in 2017.
Third-order effects
- If trusted security tooling keeps producing exploitable flaws — from AVG's extension to Microsoft's engine to AVGater's quarantine escape — buyers and regulators may start demanding independent auditability of the privileged software that sits deepest in the trust chain.
The trend: Security software itself is becoming a primary attack surface, with each disclosed flaw in antivirus engines, extensions, and quarantine mechanisms eroding the assumption that trusted tools are outside the threat model.